diff --git a/contrib/liblokinet/tcp_connect.cpp b/contrib/liblokinet/tcp_connect.cpp
index 3f4890eb5..99b781a20 100644
--- a/contrib/liblokinet/tcp_connect.cpp
+++ b/contrib/liblokinet/tcp_connect.cpp
@@ -31,7 +31,7 @@ main(int argc, char* argv[])
 {
   if (argc < 3 || argc > 4)
   {
-    std::cout << "Usage: " << argv[0] << " something.{loki,snode} port [testnet]\n";
+    std::cerr << "Usage: " << argv[0] << " something.{loki,snode} port [testnet]\n";
     return 0;
   }
 
@@ -52,7 +52,7 @@ main(int argc, char* argv[])
   else
     lokinet_log_level("info");
 
-  std::cout << "starting up\n";
+  std::cerr << "starting up\n";
 
   lokinet_set_netid(netid.c_str());
   auto shared_ctx = std::shared_ptr<lokinet_context>(lokinet_context_new(), lokinet_context_free);
@@ -64,33 +64,31 @@ main(int argc, char* argv[])
   int status;
   for (status = lokinet_status(ctx); _run and status == -1; status = lokinet_status(ctx))
   {
-    std::cout << "waiting for lokinet to be ready..." << std::endl;
+    std::cerr << "waiting for lokinet to be ready..." << std::endl;
     std::this_thread::sleep_for(std::chrono::milliseconds{500});
   }
   if (not _run)
   {
-    std::cout << "exit requested before context was ready.\n";
+    std::cerr << "exit requested before context was ready.\n";
     return 0;
   }
   if (status != 0)
   {
-    std::cout << "lokinet_status = " << status << " after waiting for ready.\n";
+    std::cerr << "lokinet_status = " << status << " after waiting for ready.\n";
     return 0;
   }
 
-  // log level debug for quic
-  llarp::log::set_level("quic", llarp::log::Level::trace);
-  //llarp::log::set_level("quic", llarp::log::Level::debug);
-  std::cout << "\n\nquic log level: " << llarp::log::to_string(llarp::log::get_level("quic")) << "\n\n";
+  if (auto* loglevel = getenv("QUIC_LOG"))
+    llarp::log::set_level("quic", llarp::log::level_from_string(loglevel));
+  else
+    llarp::log::set_level("quic", llarp::log::Level::trace);
+
+  std::cerr << "\n\nquic log level: " << llarp::log::to_string(llarp::log::get_level("quic")) << "\n\n";
 
   auto addr_c = lokinet_address(ctx);
   std::string addr{addr_c};
   free(addr_c);
-  std::cout << "lokinet address: " << addr << "\n";
-
-  // wait a bit just so log output calms down so we can see stuff
-  // printed from here
-  std::this_thread::sleep_for(std::chrono::milliseconds{3000});
+  std::cerr << "lokinet address: " << addr << "\n";
 
   lokinet_stream_result stream_res;
 
@@ -101,20 +99,16 @@ main(int argc, char* argv[])
 
   if (stream_res.error)
   {
-    std::cout << "failed to prepare outbound tcp: " << strerror(stream_res.error) << "\n";
+    std::cerr << "failed to prepare outbound tcp: " << strerror(stream_res.error) << "\n";
     return 0;
   }
 
-
-  size_t counter = 0;
   do
   {
     std::this_thread::sleep_for(std::chrono::milliseconds{100});
-    if (counter++ % 30 == 0)
-      std::cout << "outbound tcp ready on " << stream_res.local_address << ":" << stream_res.local_port << "\n";
   } while (_run);
 
-  std::cout << "tcp_connect shutting down...\n";
+  std::cerr << "tcp_connect shutting down...\n";
 
   lokinet_close_stream(stream_res.stream_id, ctx);
   return 0;
diff --git a/llarp/quic/connection.cpp b/llarp/quic/connection.cpp
index 33252b94f..02b1adf5c 100644
--- a/llarp/quic/connection.cpp
+++ b/llarp/quic/connection.cpp
@@ -54,7 +54,7 @@ namespace llarp::quic
 #pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Wunused-parameter"
 
-    constexpr int FAIL = NGTCP2_ERR_CALLBACK_FAILURE;
+    constexpr int CALLBACK_FAIL = NGTCP2_ERR_CALLBACK_FAILURE;
 
     int
     client_initial(ngtcp2_conn* conn_, void* user_data)
@@ -78,7 +78,7 @@ namespace llarp::quic
       assert(conn_ == conn.conn.get());
 
       if (0 != conn.setup_server_crypto_initial())
-        return FAIL;
+        return CALLBACK_FAIL;
 
       return 0;
     }
@@ -100,7 +100,7 @@ namespace llarp::quic
         case NGTCP2_CRYPTO_LEVEL_EARLY:
           // We don't currently use or support 0rtt
           log::warning(logcat, "Invalid EARLY crypto level");
-          return FAIL;
+          return CALLBACK_FAIL;
 
         case NGTCP2_CRYPTO_LEVEL_INITIAL:
           // "Initial" level means we are still handshaking; if we are server then we receive
@@ -109,14 +109,23 @@ namespace llarp::quic
           // server, which is that returned server transport params.
 
           if (auto rv = conn.recv_initial_crypto(data); rv != 0)
+          {
+            log::debug(logcat, "conn.recv_initial_crypto() returned error: {}", ngtcp2_strerror(rv));
             return rv;
+          }
 
           if (ngtcp2_conn_is_server(conn))
           {
             if (auto rv = conn.send_magic(NGTCP2_CRYPTO_LEVEL_INITIAL); rv != 0)
+            {
+              log::debug(logcat, "conn.send_magic() returned error: {}", ngtcp2_strerror(rv));
               return rv;
+            }
             if (auto rv = conn.send_transport_params(NGTCP2_CRYPTO_LEVEL_HANDSHAKE); rv != 0)
+            {
+              log::debug(logcat, "conn.send_transport_params() returned error: {}", ngtcp2_strerror(rv));
               return rv;
+            }
           }
 
           break;
@@ -125,20 +134,26 @@ namespace llarp::quic
           if (!ngtcp2_conn_is_server(conn))
           {
             if (auto rv = conn.recv_transport_params(data); rv != 0)
+            {
+              log::debug(logcat, "conn.recv_transport_params() returned error: {}", ngtcp2_strerror(rv));
               return rv;
+            }
             // At this stage of the protocol with TLS the client sends back TLS info so that
             // the server can install our rx key; we have to send *something* back to invoke
             // the server's HANDSHAKE callback (so that it knows handshake is complete) so
             // send the magic again.
             if (auto rv = conn.send_magic(NGTCP2_CRYPTO_LEVEL_HANDSHAKE); rv != 0)
+            {
+              log::debug(logcat, "conn.send_magic() returned error: {}", ngtcp2_strerror(rv));
               return rv;
+            }
           }
           else
           {
             // Check that we received the above as expected
             if (data != handshake_magic)
             {
-              log::warning(
+              log::info(
                   logcat,
                   "Invalid handshake crypto frame from client: did not find expected magic");
               return NGTCP2_ERR_CALLBACK_FAILURE;
@@ -150,12 +165,12 @@ namespace llarp::quic
 
         case NGTCP2_CRYPTO_LEVEL_APPLICATION:
           // if (!conn.init_tx_key())
-          //    return FAIL;
+          //    return CALLBACK_FAIL;
           break;
 
         default:
           log::warning(logcat, "Unhandled crypto_level {}", crypto_level);
-          return FAIL;
+          return CALLBACK_FAIL;
       }
       conn.io_ready();
       return 0;
@@ -424,7 +439,7 @@ namespace llarp::quic
     // FIXME: IPv6
     settings.max_tx_udp_payload_size = Endpoint::max_pkt_size_v4;
     settings.cc_algo = NGTCP2_CC_ALGO_CUBIC;
-    // settings.initial_rtt = ???; # NGTCP2's default is 333ms
+    // settings.initial_rtt = std::chrono::nanoseconds(333ms).count(); // NGTCP2's default is 333ms
 
     ngtcp2_transport_params_default(&tparams);
 
@@ -570,6 +585,7 @@ namespace llarp::quic
   void
   Connection::flush_streams()
   {
+    log::trace(logcat, "Connection::flush_streams()");
     // conn, path, pi, dest, destlen, and ts
     std::optional<uint64_t> ts;
 
@@ -625,7 +641,7 @@ namespace llarp::quic
 
     std::list<Stream*> strs;
     for (auto& [stream_id, stream_ptr] : streams)
-      if (stream_ptr)
+      if (stream_ptr and not stream_ptr->sent_fin)
         strs.push_back(stream_ptr.get());
 
     // Maximum number of stream data packets to send out at once; if we reach this then we'll
@@ -1035,6 +1051,7 @@ namespace llarp::quic
   void
   Connection::complete_handshake()
   {
+    log::trace(logcat, "QUIC connection call ngtcp2_conn_handshake_completed");
     endpoint.null_crypto.install_rx_key(*this);
     if (!ngtcp2_conn_is_server(*this))
       endpoint.null_crypto.install_tx_key(*this);
diff --git a/llarp/quic/endpoint.cpp b/llarp/quic/endpoint.cpp
index 0f6ad832f..e560cf793 100644
--- a/llarp/quic/endpoint.cpp
+++ b/llarp/quic/endpoint.cpp
@@ -238,13 +238,11 @@ namespace llarp::quic
   {
     log::debug(logcat, "Closing connection {}", conn.base_cid);
 
-    const ngtcp2_connection_close_error err{
-        // FIXME: propagate which type this should be to here; defaulting
-        NGTCP2_CONNECTION_CLOSE_ERROR_CODE_TYPE_TRANSPORT,
+    ngtcp2_connection_close_error err;
+    ngtcp2_connection_close_error_set_transport_error(&err,
         code,
-        0,  // 0 == unknown
         reinterpret_cast<uint8_t*>(const_cast<char*>(close_reason.data())),
-        close_reason.size()};
+        close_reason.size());
     if (!conn.closing)
     {
       conn.conn_buffer.resize(max_pkt_size_v4);
@@ -339,8 +337,8 @@ namespace llarp::quic
 
         // a bit of buffer on the expiration time in case the last call to
         // ngtcp2_conn_get_expiry() returned ~0ms from now and the connection
-        // hasn't had time to handle it yet.  2ms should do.
-        if (exp >= (now_ts - 2'000'000) || conn.draining)
+        // hasn't had time to handle it yet.  5ms should do.
+        if (exp >= (now_ts - 5'000'000) || conn.draining)
           continue;
         log::debug(logcat, "Draining connection {}", it->first);
         start_draining(conn);
diff --git a/llarp/quic/null_crypto.cpp b/llarp/quic/null_crypto.cpp
index a18e4c1d6..bd08cecb3 100644
--- a/llarp/quic/null_crypto.cpp
+++ b/llarp/quic/null_crypto.cpp
@@ -26,6 +26,7 @@ namespace llarp::quic
   void
   NullCrypto::client_initial(Connection& conn)
   {
+    log::debug(logcat, "Client initial null crypto setup");
     ngtcp2_conn_set_initial_crypto_ctx(conn, &null_ctx);
     ngtcp2_conn_install_initial_key(
         conn,
diff --git a/llarp/quic/tunnel.cpp b/llarp/quic/tunnel.cpp
index 732a702b4..5efb83988 100644
--- a/llarp/quic/tunnel.cpp
+++ b/llarp/quic/tunnel.cpp
@@ -538,7 +538,7 @@ namespace llarp::quic
           [this,
            after_path = std::move(after_path),
            pport = pport,
-           remote_addr = remote_addr](auto maybe_remote) {
+           remote_addr](auto maybe_remote) {
             if (not continue_connecting(
                     pport, (bool)maybe_remote, "endpoint ONS lookup", remote_addr))
               return;